REMARKS 

Claims 1-22 are pending in the application. Claim 22 is newly presented. 
Reconsideration of this application is respectfully requested. 

The Office Action rejects claims 1, 2, 5, 9, 10, 12, 16-19 and 21 under 35 U.S.C. 
102(b) as anticipated by U.S. Patent No. 6,535,855 to Cahill et al., hereafter Cahill. 

This rejection is respectively traversed. Cahill lacks each of the steps of claims 1 
and 16 and the traceback program functions of claim 9. Therefore, the rejection is 
erroneous. 

Since claims 1 and 9 recite similar steps and program functions, claim 1 will be 
discussed by way of example. The Examiner contends that Cahill teaches a method for 
tracing a denial of service attack on a victim machine back towards its source, comprising 
"operating a traceback program on at least one path to receive two input parameters, (a) 
an IP address (v) of the victim machine and (b) an IP address (r) of a router that is 
immediately upstream of the victim machine (column 45, lines 47-65)". However, this is 
not true. Cahill does not deal with denial-of-service attacks at all. Cahill is certainly not 
about tracing back to the source of a denial of service attack. Rather, Cahill describes a 
system which provides notifications to customers of an institution (such as a bank or 
brokerage house) that could potentially impact those customers based on market 
conditions, a customer's unique situation and pre-arranged instructions. (See the 
description in the abstract, for example.) 

The Examiner cites column 45, lines 47-65, of Cahill as support for the contention 
that Cahill discloses "operating a traceback program ...."as recited in claims 1 and 9. 
This citation merely refers to the information that a system, which provides notifications 
to customers, uses to reach those customers, e.g. a field that says use skytel and a pager 
pin number or a browser at an IP address. This citation also discusses attributes that 
indicate whether the customer should be notified in English or in some other language 
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and a code that should be used. This citation does not teach "operating a traceback 
program ..." as set forth in claims 1 and 9. 

The Examiner contends that Cahill teaches "determining a set of routers that are 
neighbors (n) of r" in a method for tracing a denial-of-service attack on a victim machine 
back towards its source. But again, Cahill does not teach a method for tracing a denial- 
of-service attack on a victim machine back towards its source. Furthermore, Cahill does 
not teach in column 49, line 61 to column 50, line 15, "determining a set of routers that 
are neighbors" of a router r. Cahill does not disclose or teach a "set of routers" that are 
neighbors of a router r. In fact, there is no "router r" in Cahill. Cahill is actually talking 
about passing a message that is received from a customer to a "response router", which 
has nothing to do with tracing back from a machine that is a victim of a denial-of-service 
attack to the source of the attack. 

The Examiner contends that Cahill discloses "for each neighbor n of r, 

determining if r is n's next hop for traffic addressed to v, or to a network that v is on ", 

citing column 50, lines 21-46. This citation has nothing to do with anything related to 
claims 1, 9 & 16. This citation discusses some things that happen on a client device in a 
system that provides notifications to customers but it does not discuss "for each neighbor 
n of r, determining if r is n's next hop for traffic addressed to v, or to a network that v is 
on ", as recited in claims 1 and 9. 

The Examiner contends that Cahill discloses "if r is not n's next-hop for traffic 
addressed to v, skip over n and query the next neighbor of r, while if r is n's next-hop for 
traffic addressed to v, determining an amount of traffic that n is forwarding to r that is 
addressed to v (column 53, lines 8-32)". However, this citation does not teach "if r is not 
n's next-hop for traffic addressed to v, skip over n and query the next neighbor of r" nor 
does it teach "if r is n's next-hop for traffic addressed to v, determining an amount of 
traffic that n is forwarding to r". Moreover, this citation does not teach a method for 
tracing a denial-of-service attack. The citation merely discusses some things that are 
done in a system that provides notifications to customers. 
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The Examiner contends that Cahill discloses "after determining the identity of the 
neighbor n of r that is the principal source of packets flowing to r that are addressed to v, 
continuing one node further upstream from the determined neighbor n of r that is the 
principal source of packets flowing to r that are addressed to v, and continuing to 
traceback through interconnected routers until a source of denial-of-service attack packets 
to v is determined or until further traceback is not possible (column 13, lines 47-55)". 
However, this citation does not support the Examiner's contention. This citation does not 
disclose "after determining the identity ..." nor does it teach a method for tracing a denial- 
of-service attack. This citation describes about how two parties mutually authenticate 
each other via unique 256-bit identification numbers. Thus, this citation does not support 
the Examiner's contention, which is, therefore, erroneous. 

The Examiner did not provide a step by step reading of Claim 16 on Cahill. 
Cahill does not disclose any of the steps recited in claim 16. 

Cahill does not disclose the "operating a traceback function" step of claim 16. As 
discussed above, the column 45, lines 47-65 citation merely refers to the information that 
a system, which provides notifications to customers, uses to reach those customers, e.g. a 
field that says use skytel and a pager pin number or a browser at an IP address. This 
citation also discusses attributes that indicate whether the customer should be notified in 
English or in some other language and a code that should be used. This citation does not 
teach "operating a traceback function..." as set forth in claim 16. 

Cahill does not disclose the "determining a set of routers" step of claim 16. As 
discussed above, the column 49, line 61 to column 50, line 15 citation does not disclose 
or teach a "set of routers" that are neighbors of a router r. In fact, there is no "router r" in 
Cahill. Cahill is actually talking about passing a message that is received from a 
customer to a "response router", which has nothing to do with tracing back from a 
machine that is a victim of a denial-of-service attack to the source of the attack. 
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Cahill does not disclose the "querying individual ones of packet routers" step of 
claim 16. As discussed above, the column 13, lines 47-55, citation does not disclose " 
querying individual ones of packet routers" nor does it teach a method for tracing a 
denial-of-service attack. This citation describes about how two parties mutually 
authenticate each other via unique 256-bit identification numbers. Thus, this citation 
does not disclose the "querying individual ones" step of claim 16. 

For the reason set forth above, it is submitted that the rejection of claims 1, 2, 5, 9, 
10, 12, 16-19 and 21 under 35 U.S.C. 102(b) as anticipated by Cahill is erroneous and 
should be withdrawn. 

The Office Action rejects claims 3, 4 and 1 1 under 35 U.S.C 103(a) as 
unpatentable over Cahill as applied to claims 1 and 9 and further in view of U.S Patent 
No. 6,535,507 to Li et al., hereafter Li. 

This rejection is erroneous because Li does not provide any of the steps which 
Cahill lacks as discussed above in the rejection of independent claims 1 and 9 from which 
claims 3, 4 and 1 1 depend. Therefore, the combination of Cahill and Li lacks the steps 
recited in these claims. 

For the reason set forth above, it is submitted that the rejection of claims 3, 4 and 
1 1 under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action rejects claims 6 and 13 under 35 U.S.C 103(a) as unpatentable 
over Cahill as applied to claims 1 and 9 and further in view of U.S Patent No. 5,963,540 
to Bhaskaran, hereafter Bhaskaran. 

This rejection is erroneous because Bhaskaran does not provide any of the steps 
which Cahill lacks as discussed above in the rejection of independent claims 1 and 9 from 
which claims 6 and 13 depend. Therefore, the combination of Cahill and Bhaskaran 
lacks the steps recited in these claims. 
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For the reason set forth above, it is submitted that the rejection of claims 6 and 13 
under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action rejects claims 7 and 14 under 35 U.S.C 103(a) as unpatentable 
over Cahill as applied to claims 1 and 9 and further in view of U.S Patent No. 6,636,509 
to Hughes, hereafter Hughes. 

This rejection is erroneous because Hughes does not provide any of the steps 
which Cahill lacks as discussed above in the rejection of independent claims 1 and 9 from 
which claims 7 and 14 depend. Therefore, the combination of Cahill and Hughes lacks 
the steps recited in these claims. 

For the reason set forth above, it is submitted that the rejection of claims 7 and 14 
under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action rejects claims 8 and 15 under 35 U.S.C 103(a) as unpatentable 
over Cahill as applied to claims 1 and 9 and further in view of U.S Patent No. 6,298,041 
to Packer, hereafter Packer. 

This rejection is erroneous because Packer does not provide any of the steps 
which Cahill lacks as discussed above in the rejection of independent claims 1 and 9 from 
which claims 8 and 15 depend. Therefore, the combination of Cahill and Packer lacks 
the steps recited in these claims. 

For the reason set forth above, it is submitted that the rejection of claims 8 and 15 
under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action rejects claim 20 under 35 U.S.C 103(a) as unpatentable over 
Cahill as applied to claim 16 and further in view of U.S Patent No. 6,456,597 to Bare, 
hereafter Bare. 
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This rejection is erroneous because Bare does not provide any of the steps which 
Cahill lacks as discussed above in the rejection of independent claims 1 and 9 from which 
claim 20 depends. Therefore, the combination of Cahill and Bare lacks the steps recited 
in claim 20. 

Newly presented claim 22 is modeled after claim 1 with claims 5 and 6 
incorporated therein. It is submitted that new claim 22 is patentable over the cited 
references taken singly or in combination. Accordingly, it is submitted that claim 22 
distinguishes from the cited art and is, therefore, allowable. 

It is respectfully requested for the reasons set forth above that the rejections under 
35.U.S.C. 102(b) and 35 U.S.C. 103(a) be withdrawn, that claims 1-22 be allowed and 
that this application be passed to issue. 
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